9 ms·

This quote from the article highlights the problem at hand: > Organizations like the Center for Democracy and Technology, which received at least $960,000 from

by cj 7y ago

This quote from the article highlights the problem at hand: > Organizations like the Center for Democracy and Technology, which received at least $960,000 from [Google and Facebook] in 2018, are often quoted in the media as unbiased third parties and influence how policy is developed in Washington as such, despite receiving the tech company funding. > The group supports allowing tech giants to sell user data to third parties with limited restrictions, a position that is in line with technology companies that profit handsomely from such sales, but not so popular with consumers. I guess "Privacy Advocacy Groups" does not equal "Pro-Privacy Advocacy Groups".

snarf21 7y ago
Exactly. This allows them to control the narrative and even fight for small pro-privacy laws that don't affect their advertising.
loufe 7y ago
I suppose you're right. I think a major fault of this artcle was the initial lack of clarity surrounding the standpoint of these groups on the issue.
raxxorrax 7y ago
And they are quite effective. My government believes selling customer data is the road to riches. They plan to sell even patient data from mandatory governmental health services. Complete lunatics in my opinion.
- malnourish 7y ago
  If the data is truly anonymized (and that's a big if), would you still have an issue? Could you share which government is doing this? It is very troubling. Edit: thank you all for good responses, I wasn't aware of the risks of de-anonymization but I will do more research into this.
  - bogwog 7y ago
    > If the data is truly anonymized (and that's a big if), would you still have an issue? Hell yes. The only time it's acceptable is if they get my informed consent.
  - shakna 7y ago
    _Can_ any large dataset actually be anonymised effectively? I'm not yet convinced it can be done in a way that can't trivially be reversed by anyone combining it with other datasets. And if it can't be anonymised, then it probably shouldn't be saleable.
    - imglorp 7y ago
      Furthermore, the data may be static, but de-anonymization capabilities are not and may improve over time to identify someone. For example, if they're tracking all instances of various ailments seen by some doctor in some time period. Suppose you are the only person of a given age and gender with that ailment, so that bucket would one entry for anonymous you. Fine. But then suppose the aggregating party begins to buy and correlate against credit card and location records that place you at the doctor's office in that time frame, bingo, they have a match to tie all three data.
    - jackpirate 7y ago
      The US Census famously used differential privacy in their most recent surveys. They have a quite extensive analysis of the tradeoffs they had to make to ensure everyone's privacy, and there is a fairly large body of academic work that analyzes (e.g.) the economic impact of this privacy preservation. The general consensus AFAIK is that they did a great job. See https://arxiv.org/abs/1809.02201 https://arxiv.org/abs/1809.02201 for the main paper from the Census.
      - shakna 7y ago
        I'm not sure that this can be done with certain datasets, like health data. If you had access to anonymised health data from my nation, for example, picking me personally out of the records would be extremely trivial, using just two data points: + I have an illness that only 1% of people have. + I lost my spleen whilst I was in primary school. Both of those things are actually a matter of public record, thanks to being mentioned in various local newspapers, so it's reasonable to assume someone somewhere has that data. I believe the general consensus on health data is that you have the age a person was at an incident, and the nature of an incident, you only need to have two or three incidents in your database to de-anonymise their records. The only way to combat it is to not provide the detail required for the analysis that is exactly what the above organisations wish to do. No profiles, no fine-grained demographics. And yet, people with rarer illnesses or events than mine will still stand out, so you also need to eliminate them from the dataset, even though they may well be the ones who could benefit most from this sort of widescale analysis.
nihonde 7y ago
This has been going on since the 1990’s. Take a look at TrustE/TrustArc: https://en.m.wikipedia.org/wiki/TrustArc https://en.m.wikipedia.org/wiki/TrustArc
mcguire 7y ago
My first cynical question on seeing the headline was, "Real privacy, or are they trying to protect their business, perhaps by limiting competition?" I see I'm not cynical enough.
AnthonyMouse 7y ago
The problem with this theory is that it doesn't align with facts. Google and most of the other major tech companies don't actually sell user data. They collect it to use internally. The biggest companies who actually do that are the ISPs, but that doesn't really fit the same narrative, and I doubt they donate a lot to privacy groups. The reason a lot of privacy groups don't try to restrict selling user data is a combination of a potentially legitimate first amendment problem with restricting it and a finite amount of political capital. Sometimes political capital has to be spent making sure that e.g. the FBI director doesn't push through a law against strong encryption. Sometimes it's better to have a bill that improves privacy a little and actually passes than a bill that improves privacy a lot but never makes it into law, or start with one that isn't as easy for Comcast to have struck down by the courts and in so doing create a problematic legal precedent. Meanwhile you ask why Google and Facebook donate to privacy groups, but their goals are actually aligned on a lot of things, like promoting the use of HTTPS over HTTP and opposition to draconian copyright laws. This is gotcha journalism, and it's problematic because what are you proposing as a solution? That privacy groups stop accepting money from tech companies? What that would do is cause them to have less money for privacy advocacy. Ask yourself who benefits from that.
- amilein7minutes 7y ago
  Could you explain why the restriction over selling user data would be a violation of first amendment rights? Overall, isn't your last point also the source of problems? If the whole idea is to be able to exert regulatory control, to protect users, over companies that seem to have a huge share on decision-making in this space due to their unmatched wealth, how is their parting with a minuscule portion of their wealth so they can potentially influence a decision made on the topic of restricting them, solve any problems in the first place? It seems like a stretch to suggest that privacy advocacy groups need money from tech giants to support themselves. I agree that every organization needs the money but the problem at hand is that every organization should not ideally depend on tech company donations because they have amassed the largest sums. Since this is the problem these laws are trying to address in the first place, I am not sure taking donations from tech giants would solve the problem, even if it doesn't exacerbate it (assuming for a moment that the tech giants are actually being a force of good here).
PeterStuer 7y ago
The more correct headline would be "Facebook, Google Donate Heavily to Privacy Deregulation Advocacy Groups".
throwaway829 7y ago
Looks like a classic example of controlled opposition.

by cj 7y ago

snarf21 7y ago

Exactly. This allows them to control the narrative and even fight for small pro-privacy laws that don't affect their advertising.

loufe 7y ago

I suppose you're right. I think a major fault of this artcle was the initial lack of clarity surrounding the standpoint of these groups on the issue.

raxxorrax 7y ago

And they are quite effective. My government believes selling customer data is the road to riches. They plan to sell even patient data from mandatory governmental health services. Complete lunatics in my opinion.

malnourish 7y ago
If the data is truly anonymized (and that's a big if), would you still have an issue? Could you share which government is doing this? It is very troubling. Edit: thank you all for good responses, I wasn't aware of the risks of de-anonymization but I will do more research into this.
- bogwog 7y ago
  > If the data is truly anonymized (and that's a big if), would you still have an issue? Hell yes. The only time it's acceptable is if they get my informed consent.
- shakna 7y ago
  _Can_ any large dataset actually be anonymised effectively? I'm not yet convinced it can be done in a way that can't trivially be reversed by anyone combining it with other datasets. And if it can't be anonymised, then it probably shouldn't be saleable.
  - imglorp 7y ago
    Furthermore, the data may be static, but de-anonymization capabilities are not and may improve over time to identify someone. For example, if they're tracking all instances of various ailments seen by some doctor in some time period. Suppose you are the only person of a given age and gender with that ailment, so that bucket would one entry for anonymous you. Fine. But then suppose the aggregating party begins to buy and correlate against credit card and location records that place you at the doctor's office in that time frame, bingo, they have a match to tie all three data.
  - jackpirate 7y ago
    The US Census famously used differential privacy in their most recent surveys. They have a quite extensive analysis of the tradeoffs they had to make to ensure everyone's privacy, and there is a fairly large body of academic work that analyzes (e.g.) the economic impact of this privacy preservation. The general consensus AFAIK is that they did a great job. See https://arxiv.org/abs/1809.02201 https://arxiv.org/abs/1809.02201 for the main paper from the Census.
    - shakna 7y ago
      I'm not sure that this can be done with certain datasets, like health data. If you had access to anonymised health data from my nation, for example, picking me personally out of the records would be extremely trivial, using just two data points: + I have an illness that only 1% of people have. + I lost my spleen whilst I was in primary school. Both of those things are actually a matter of public record, thanks to being mentioned in various local newspapers, so it's reasonable to assume someone somewhere has that data. I believe the general consensus on health data is that you have the age a person was at an incident, and the nature of an incident, you only need to have two or three incidents in your database to de-anonymise their records. The only way to combat it is to not provide the detail required for the analysis that is exactly what the above organisations wish to do. No profiles, no fine-grained demographics. And yet, people with rarer illnesses or events than mine will still stand out, so you also need to eliminate them from the dataset, even though they may well be the ones who could benefit most from this sort of widescale analysis.

nihonde 7y ago

This has been going on since the 1990’s. Take a look at TrustE/TrustArc: https://en.m.wikipedia.org/wiki/TrustArc https://en.m.wikipedia.org/wiki/TrustArc

mcguire 7y ago

My first cynical question on seeing the headline was, "Real privacy, or are they trying to protect their business, perhaps by limiting competition?" I see I'm not cynical enough.

AnthonyMouse 7y ago

The problem with this theory is that it doesn't align with facts. Google and most of the other major tech companies don't actually sell user data. They collect it to use internally. The biggest companies who actually do that are the ISPs, but that doesn't really fit the same narrative, and I doubt they donate a lot to privacy groups. The reason a lot of privacy groups don't try to restrict selling user data is a combination of a potentially legitimate first amendment problem with restricting it and a finite amount of political capital. Sometimes political capital has to be spent making sure that e.g. the FBI director doesn't push through a law against strong encryption. Sometimes it's better to have a bill that improves privacy a little and actually passes than a bill that improves privacy a lot but never makes it into law, or start with one that isn't as easy for Comcast to have struck down by the courts and in so doing create a problematic legal precedent. Meanwhile you ask why Google and Facebook donate to privacy groups, but their goals are actually aligned on a lot of things, like promoting the use of HTTPS over HTTP and opposition to draconian copyright laws. This is gotcha journalism, and it's problematic because what are you proposing as a solution? That privacy groups stop accepting money from tech companies? What that would do is cause them to have less money for privacy advocacy. Ask yourself who benefits from that.

amilein7minutes 7y ago
Could you explain why the restriction over selling user data would be a violation of first amendment rights? Overall, isn't your last point also the source of problems? If the whole idea is to be able to exert regulatory control, to protect users, over companies that seem to have a huge share on decision-making in this space due to their unmatched wealth, how is their parting with a minuscule portion of their wealth so they can potentially influence a decision made on the topic of restricting them, solve any problems in the first place? It seems like a stretch to suggest that privacy advocacy groups need money from tech giants to support themselves. I agree that every organization needs the money but the problem at hand is that every organization should not ideally depend on tech company donations because they have amassed the largest sums. Since this is the problem these laws are trying to address in the first place, I am not sure taking donations from tech giants would solve the problem, even if it doesn't exacerbate it (assuming for a moment that the tech giants are actually being a force of good here).

PeterStuer 7y ago

The more correct headline would be "Facebook, Google Donate Heavily to Privacy Deregulation Advocacy Groups".

throwaway829 7y ago

Looks like a classic example of controlled opposition.